A value that separates an IP address into its network and host portions.
A subnet mask is a 32-bit value written in dotted-decimal notation (such as 255.255.255.0) that identifies which bits of an IP address belong to the network and which belong to the host. A device performs a bitwise AND of the mask against a destination IP to extract the network address and decide whether traffic is local or must be routed. On N10-009, know that a subnet mask and a CIDR prefix carry identical information expressed differently: 255.255.255.0 equals /24. Borrowing host bits creates more subnets but fewer hosts; subtract 2 per subnet for the network and broadcast addresses.
Classless Inter-Domain Routing — a notation like /24 that shows how many bits are the network prefix.
Classless Inter-Domain Routing replaced the old Class A/B/C system by allowing any prefix length from /0 to /32, giving engineers precise control over how address space is divided. A block like 192.168.10.0/26 allocates exactly 64 addresses (62 usable) instead of forcing a full Class C. This efficiency helped grow the internet by enabling route summarization, which shrinks routing tables.
The key exam point is that CIDR notation and subnet masks express the same information differently, so /26 equals 255.255.255.192. Variable-length subnet masking (VLSM) relies on CIDR, letting differently-sized subnets be carved from one address block.
Dividing one IP network into smaller subnetworks to improve organization and reduce broadcast traffic.
Subnetting divides a single IP block into smaller subnetworks by borrowing bits from the host portion. Each borrowed bit doubles the subnet count while halving hosts per subnet. Usable hosts equal 2^h − 2, where h is the remaining host bits; the two reserved addresses are the network address and the directed broadcast. On the N10-009 exam, questions give a host requirement and ask for the correct CIDR prefix. A common trap is picking the prefix that fits exactly — a /27 yields just 30 hosts for a 30-host need, leaving no growth room. Verify 2^h − 2 meets or exceeds the requirement.
Domain Name System — resolves human-readable names like example.com into IP addresses.
DNS (Domain Name System) is a hierarchical, distributed naming system that translates fully qualified domain names into IP addresses, and the reverse, so devices can locate each other without memorizing numeric addresses. Resolution moves through a recursive resolver, root name servers, TLD servers, and the authoritative name server for the domain. On the Network+ exam, know DNS uses UDP port 53 for standard queries and TCP port 53 for zone transfers or responses exceeding 512 bytes. Don’t confuse a CNAME (alias to another hostname) with an A record (hostname-to-IPv4 mapping); a CNAME cannot coexist with the SOA at a zone apex.
Dynamic Host Configuration Protocol — automatically assigns IP addresses and network settings to clients.
Dynamic Host Configuration Protocol automates the assignment of IP addresses, subnet masks, default gateways, and DNS server addresses to network clients. A DHCP server leases an address for a defined period; when the lease expires the client must renew or obtain a new address. The protocol operates over UDP, using port 67 on the server side and port 68 on the client side. The exam frequently tests the DORA exchange sequence alongside scope concepts such as lease time and exclusion ranges. A common confusion is conflating DHCP with APIPA: when a client cannot reach a DHCP server, Windows automatically self-assigns a link-local address in the 169.254.0.0/16 range via APIPA — a telltale sign of a DHCP failure during troubleshooting.
Network Address Translation — maps private internal IPs to one or more public IPs to reach the internet.
Network Address Translation rewrites IP header information as packets pass through a router, letting private RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) reach the public internet through one or more registered public IPs. A translation table maps return traffic to the correct internal host. It distinguishes three types: static NAT maps one private IP to one fixed public IP, dynamic NAT draws from a pool of public addresses, and PAT (NAT overload) maps many hosts to one IP using unique source ports. PAT dominates SOHO routers; confusing it with dynamic NAT is a frequent exam trap.
The router address a host sends traffic to when the destination is outside its local subnet.
A default gateway is the IP address of the router interface on the local subnet that a host forwards packets to when the destination falls outside that subnet. The host ANDs the destination address with its own subnet mask; any non-matching traffic is sent to the gateway rather than delivered directly on the local segment. On the N10-009 exam, distinguish the default gateway (a host-side IP setting) from a default route (0.0.0.0/0, a router-side forwarding entry). A misconfigured or missing gateway lets a host reach local devices normally but blocks all inter-network traffic — a classic troubleshooting isolation point.
Numbered endpoints (0 to 65535) that identify which service a packet is destined for.
Port numbers divide into three ranges defined by IANA: well-known ports (0 to 1023) are reserved for standard services and require elevated privileges to bind; registered ports (1024 to 49151) are assigned to vendor applications such as RDP on 3389 and MySQL on 3306; dynamic or ephemeral ports (49152 to 65535) are assigned temporarily by the OS for the client side of a connection. For the N10-009 exam, the critical distinction is transport protocol: some services use TCP (FTP control on 21, SMTP on 25, HTTP on 80), others use UDP (TFTP on 69, SNMP on 161), and DNS on 53 uses both. Confusing TCP with UDP for the same port number is a common distractor.
HTTP secured with TLS encryption, running on port 443 for safe web browsing.
HTTPS is HTTP layered over TLS (Transport Layer Security), which authenticates the server via a digital certificate and then encrypts traffic between browser and server. The handshake establishes a symmetric session key, so captured packets remain unreadable. Port 443 is the well-known TCP port for HTTPS; port 80 carries unencrypted HTTP.
The exam distinction worth noting is that HTTPS verifies the server and encrypts the channel, but does not verify the identity of the user. A browser padlock means the connection is encrypted, not that the site is trustworthy — a common point of confusion on scenario questions.
Secure Shell — an encrypted protocol on port 22 for remote command-line administration.
SSH (Secure Shell) operates on TCP port 22, using asymmetric key exchange during the handshake to establish a symmetric session key that then encrypts the entire data stream. It authenticates users with passwords or, more securely, with public/private key pairs listed in authorized_keys files. Network+ candidates should know SSH as the direct replacement for Telnet, which sends credentials in plaintext on port 23. Unlike HTTPS (port 443), SSH is terminal/CLI-based and is the standard for managing routers, switches, and Linux servers remotely. SCP and SFTP both run over SSH for encrypted file transfers.
The physical or logical arrangement of devices and links in a network, such as star, mesh, or bus.
Network topology describes how devices and links are arranged, either physically (how cables run) or logically (how data flows regardless of layout). The N10-009 exam covers star, where devices connect to a central switch; bus, a single shared cable now largely obsolete; ring, where data travels in a loop; and mesh, where nodes interconnect directly. Full mesh gives every node a direct path to every other for maximum redundancy, while partial mesh balances cost and fault tolerance. Master physical versus logical: classic Ethernet over twisted-pair is a physical star but a logical bus, with all nodes sharing one collision domain through a hub.
Copper cabling with pairs twisted to cancel interference, used for most Ethernet runs (e.g. Cat 6).
Twisted pair cabling uses copper wire pairs wound around each other to reduce electromagnetic interference and crosstalk. Both wires pick up nearly identical noise, which the differential receiver cancels as common-mode interference. Cat 5e runs 1 Gbps at 100 MHz, Cat 6 reaches 10 Gbps over short runs (about 55 meters) at 250 MHz, and Cat 6a extends 10 Gbps to the full 100-meter limit at 500 MHz. The key exam distinction is UTP versus STP: UTP is the default, while STP adds foil or braided shielding for noisy areas but needs proper grounding.
Cabling that carries data as light pulses, offering long distance and immunity to electromagnetic interference.
Fiber optic cabling transmits data as pulses of light through a glass or plastic core, making it immune to electromagnetic interference and capable of far greater distances and bandwidth than copper. Single-mode fiber (SMF) uses a narrow core and a laser source to reach many kilometers, while multimode fiber (MMF) uses a wider core with LED or VCSEL sources for shorter campus runs. A common exam trap is confusing connectors with cable type: LC connectors are small-form-factor and dominate data centers, while SC connectors are larger and common in older runs. Neither connector determines single-mode versus multimode — that lives in the fiber and its transceiver.
A single copper core surrounded by shielding, commonly used for cable internet and broadband.
Coaxial cable has a central copper conductor surrounded by a dielectric insulator, a braided metal shield, and an outer jacket. That shielding resists electromagnetic interference, suiting coax to broadband runs. Today it is most associated with cable internet delivered via DOCSIS (Data Over Cable Service Interface Specification), riding the same plant as cable television. On the Network+ exam, watch the connectors: F-type is standard for DOCSIS cable modems, while BNC appears in legacy 10BASE2 (Thinnet) Ethernet. Modern Ethernet runs on twisted-pair or fiber, so coax’s active role is almost entirely last-mile broadband.
Networking delivered through cloud providers, using virtual networks, gateways, and connectivity to on-premises sites.
Cloud networking moves routers, switches, firewalls, and load balancers out of a physical data center and into a provider-managed environment. Administrators define virtual networks, subnets, route tables, and security groups through software rather than hardware. The service models matter because the tenant’s networking responsibility shrinks from IaaS, where you manage the OS and above, through PaaS to SaaS, where the provider manages everything. A key exam distinction is the site-to-site VPN, an encrypted tunnel over the public internet, versus a dedicated direct-connect circuit, which bypasses the internet for lower latency and predictable throughput.